feat: implement RPC transport, WASM inspection, analysis and config APIs

.github/workflows/ci.yml

@@ -22,8 +22,8 @@ jobs:
     name: Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt
       - run: cargo fmt --all -- --check
@@ -32,12 +32,12 @@ jobs:
     name: Clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo clippy --all-targets --all-features -- -D warnings
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
+      - run: cargo clippy --locked --all-targets --all-features -- -D warnings
 
   test:
     name: Test (${{ matrix.os }})
@@ -47,7 +47,18 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo test --all --all-features
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
+      - run: cargo test --locked --all --all-features
+
+  msrv:
+    name: MSRV (Rust 1.91.0)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: 1.91.0
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
+      - run: cargo test --locked --all --all-features

.github/workflows/fuzz.yml

@@ -24,9 +24,11 @@ jobs:
     name: Fuzz smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@nightly
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # pinned action
+        with:
+          toolchain: nightly
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
         with:
           workspaces: fuzz
       - name: Install cargo-fuzz

.github/workflows/release-validation.yml

@@ -0,0 +1,24 @@
+name: Release validation
+
+on:
+  push:
+    tags: ["v*.*.*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate release artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo fmt --all -- --check
+      - run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+      - run: cargo test --workspace --all-features
+      - run: cargo package --workspace --no-verify

.github/workflows/security-audit.yml

@@ -0,0 +1,41 @@
+name: Dependency Security Audit
+
+on:
+  pull_request:
+    paths:
+      - "Cargo.lock"
+      - "**/Cargo.toml"
+      - ".github/workflows/security-audit.yml"
+  push:
+    branches: [main]
+    paths:
+      - "Cargo.lock"
+      - "**/Cargo.toml"
+      - ".github/workflows/security-audit.yml"
+  schedule:
+    - cron: "23 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-audit-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    name: RustSec advisory audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      - name: Audit locked dependencies
+        run: cargo audit --file Cargo.lock

.github/workflows/upload-sarif.yml

@@ -0,0 +1,41 @@
+name: Upload contract analysis to GitHub code scanning
+
+on:
+  workflow_dispatch:
+    inputs:
+      wasm_path:
+        description: Repository-relative path to a Soroban contract WASM artifact
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - name: Validate artifact path
+        env:
+          WASM_PATH: ${{ inputs.wasm_path }}
+        shell: bash
+        run: |
+          case "$WASM_PATH" in
+            ""|/*|..|../*|*/../*|*/..) echo "wasm_path must be a repository-relative path without parent traversal" >&2; exit 2 ;;
+          esac
+          test -f "$WASM_PATH" || { echo "WASM artifact not found in repository" >&2; exit 2; }
+      - name: Generate SARIF report
+        env:
+          WASM_PATH: ${{ inputs.wasm_path }}
+        run: cargo run --locked --bin stellar-foundry -- --format sarif analyze-wasm "$WASM_PATH" > results.sarif
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3
+        with:
+          sarif_file: results.sarif
+          category: stellar-foundry-contract-analysis

CHANGELOG.md

@@ -9,34 +9,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Workspace with `devkit-core`, `devkit-xdr`, and `devkit-cli`.
-- `devkit-core`: `DevkitError`, `Network` profiles with canonical passphrases,
-  `OutputFormat`.
-- `devkit-xdr`: decode base64 `ScVal`, `TransactionEnvelope`, and
-  `ContractEvent` to JSON with bounded reading; classify Stellar strkeys.
-- `stellar-foundry` CLI: `version`, `doctor`, `strkey`, `scval`, `envelope`,
-  `event`, with terminal and JSON output and stable exit codes.
-- `devkit-rpc`: typed Stellar RPC protocol layer with an injectable `Transport`,
-  a deterministic `MockTransport`, validated `Endpoint` (https only; loopback
-  `http`; no embedded credentials), typed `Health` / `NetworkInfo` /
-  `LatestLedger`, `getEvents` and `getFeeStats` passthrough, and a retry policy
-  that retries only transport failures.
-- CLI: `endpoint <URL>` validates an RPC endpoint against the security policy.
-- Documentation: ecosystem research, architecture, getting started, CLI
-  reference, project status, roadmap.
-- CI: format, clippy, and tests on Linux, Windows, and macOS.
-- Tooling: `tools/changelog.py` generates reviewable release sections from
-  Conventional Commits; a dry-run workflow runs on demand and on release.
-- Benchmark: `cargo run --release -p devkit-xdr --example mem_profile` reports
-  peak and current memory per decode input size (see `docs/MEMORY.md`).
-- Fuzzing: `fuzz/` cargo-fuzz targets for XDR/SCVal decoding, exercised by a
-  weekly bounded scheduled workflow (see `docs/TESTING.md`).
-- Governance: README, CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, LICENSE,
-  pull-request and issue templates.
+- `devkit-contract`: bounded, non-executing WASM validation and structural
+  metadata for imports, exports, and custom sections.
+- `devkit-analysis`: deterministic structural findings with stable rule IDs
+  and SARIF 2.1.0 serialization.
+- `devkit-config`: strict TOML configuration parsing, timeout validation,
+  environment overrides, and static diagnostic events.
+- `devkit-rpc`: bounded HTTP JSON-RPC transport with timeout, redirects
+  disabled, response-size limits, response validation, and structured errors.
+- CLI commands `inspect-wasm`, `analyze-wasm`, and `rpc-health`.
+- `rpc-health` now consumes bounded TOML configuration, timeout settings, and environment overrides; endpoint precedence is explicit in the CLI reference.
+- Release-validation workflow, release checklist, Drips readiness checklist, and manual SARIF upload workflow for GitHub code scanning.
+- RustSec dependency auditing and declared Rust 1.91 workspace MSRV in PR #127.
+- Malformed-XDR regression corpus and bounded-input hardening.
+- CI: formatting, Clippy, and Linux, Windows, and macOS tests.
 
 ### Fixed
 
 - `devkit-xdr`: decoding now applies bounded reader limits instead of
   `Limits::none()`. A crafted XDR length prefix can no longer request an
   unbounded allocation (memory-exhaustion denial of service); such inputs are
   rejected as a structured decode error. Found by the `decode_scval` fuzz target.
+
+### Limitations
+
+- These changes are on open pull-request branches and are not all merged to
+  `main`.
+- `contractspecv0` XDR entries are decoded into official XDR-JSON definitions
+  with a variant kind and best-effort name; a normalized ABI schema remains future work.
+- Analysis findings are structural heuristics, not a comprehensive
+  vulnerability detector.
+- SARIF upload requires manual workflow dispatch, a repository-relative WASM
+  artifact, and GitHub code-scanning permissions.
+- The configuration API is currently wired into `rpc-health`; other commands do not consume RPC configuration because they do not need it.